Oracle Siebel CRM CVE-2026-101408

Exploitation requires the Email Marketing component of Siebel Apps - Marketing to be network-reachable over HTTP and, critically, requires human interaction from a person other than the attacker (UI:R) - a victim must click a crafted link or render attacker-supplied content. No authentication is required of the attacker (PR:N), but the dependence on tricking a legitimate user and the limited data impact (read of a subset, and update/insert/delete to only some accessible data) are the primary limiting factors. The scope change means a successful attack can reach beyond the Email Marketing component into additional connected products. Affected supported versions are 17.0 through 26.9; environments not exposing the Email Marketing web interface to untrusted users face lower realistic risk.

This is a moderate-severity (CVSS 3.1 6.1) reflected cross-site-scripting-style flaw in Oracle Siebel CRM's Email Marketing component. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical Oracle signature for stored/reflected XSS: network-reachable, low complexity, no privileges, but requiring user interaction (UI:R) and producing a scope change (S:C) with partial confidentiality and integrity impact and no availability impact. The scope change and the description's note that 'attacks may significantly impact additional products' are what elevate the score; the actual direct impact is limited (read of a subset of data, update/insert/delete to some data). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis - the raw CVSS understates nothing but is driven by scope mechanics rather than a high-impact RCE. The single-signal picture (vendor advisory only, no exploitation telemetry) means this should be patched on a normal cycle rather than treated as an emergency. Note a data conflict: the input Tags label this 'Authentication Bypass,' but the vector (UI:R, S:C, C:L/I:L, A:N, PR:N) is inconsistent with an authentication bypass and strongly indicates XSS - verify the vulnerability class against Oracle's CPU advisory.

An unauthenticated attacker crafts a malicious URL or email containing script that targets the Siebel Email Marketing component and lures a legitimate user into clicking it. When the victim's browser renders the response, attacker-controlled script executes in the Siebel session context, enabling limited reading and modification of Siebel data and potential impact on linked products via the scope change. No public exploit code was identified at time of analysis, and success depends entirely on the victim interacting with the attacker's payload.